Session Behavior Anomalies
What a customer does inside a session (path, sequence, timing, pages viewed, settings touched) compared with their own habits and with known fraud paths that end in money movement.
What it measures
Where Behavioral Biometrics look at how someone interacts (keystrokes, touch), session behavior looks at what they do and in what order:
| Feature family | Examples |
|---|---|
| Path | Pages and screens visited; entry point (deep link from a message vs app home); whether the user browsed or went straight to money movement |
| Sequence | Order of sensitive actions: contact change → password change → payout change → withdrawal; or login → add payee → raise limit → transfer |
| Timing | Time from login to first sensitive action; dwell on review screens; time of day vs habit; idle gaps |
| Exploration | Visits to security settings, notification preferences, statements, limits pages; searching help for "how to withdraw" |
| Suppression | Disabling alerts, changing notification email or phone, turning off 2FA |
| Deviation from self | The customer's usual session length, features, time and sequence vs this one |
Why it matters
Fraudulent sessions follow recognizable paths. Attackers who have taken over an account act with purpose and urgency. They check balances and limits, cut off the customer's ability to notice, redirect the payout, and cash out. Coached victims show a different but equally recognizable shape. Both differ from the customer's normal routine.
| Industry | Typical fraud-session shape |
|---|---|
| Brokerage | Login → view positions → liquidate long-held positions → change bank link → withdraw or initiate ACATS out; or rapid purchases of a thinly traded security (Ramp-and-Dump via Account Takeover, ACATS Transfer Fraud) |
| Neobank / P2P | Login from deep link → add payee → raise limit → instant transfer; alerts disabled first (Real-Time Payment Rail Fraud) |
| Rewards / cashback | Login → check balance → change payout destination → redeem everything, often to gift card (Loyalty and Rewards Redemption Fraud, Payout Redirection) |
| Marketplace | Seller account: change bank → bulk-list high-value items below market → withdraw (Seller Non-Delivery and Fake Listings) |
| Retail / ecommerce | Login → change shipping address → use stored card on high-resale items (Account Takeover (ATO)) |
| Scams (any) | Unusually long session, idle gaps, first-ever use of wire/crypto/limit features, repeated attempts after warnings (Authorized Push Payment (APP) Scams) |
Business-logic exploits have a shape too: the same flow repeated rapidly with small parameter changes, or unusual combinations of cancel and retry (Business Logic Exploitation).
How to collect it
- Build. This is your product's event stream: every screen view, API call and settings change with a session ID, account, device and timestamp. Product analytics instrumentation is often 80% of what's needed, but it must be reliable, low-latency and available to the decision engine as well as the BI warehouse. See Fraud Data Architecture and Real-Time Decisioning Architecture.
- Buy session-risk products where web and mobile instrumentation is weak, or to get population models.
- Keep sessions joined across services. A login on one service and a payout on another must share a session or correlation ID, or the sequence is invisible.
How to use it
- Encode known bad sequences as features, such as "payout destination changed within N minutes of login on a new device" or "alerts disabled in the same session as a transfer". Detailed sequences and windows belong in members playbooks.
- Score deviation from self for established customers. A customer who has only ever deposited and bought index funds, now navigating to wire withdrawal, is an outlier for them even if the action is common overall.
- Evaluate at the money-movement step, using everything that happened earlier in the session. Real-Time Transaction Risk Scoring should see the whole session along with the transaction.
- Combine with Login Anomalies, Account Change Events, Device Fingerprinting and Velocity Signals.
Strengths and limitations
Strengths: fully first-party; explainable ("they disabled alerts, changed the bank and withdrew in 4 minutes"); captures intent rather than identity.
Limitations:
- Patient attackers spread actions across sessions and days. Extend features across sessions with windows (see Velocity Signals) and treat recent account changes as persistent context.
- New customers have no personal baseline, so you have to rely on population patterns.
- Product changes alter normal paths. Every redesign can shift feature distributions, so coordinate with product teams and monitor drift (Model Risk Management).
- Sequences can be imitated once known. Assume rules leak, and keep logic in members-only and internal documentation.
False positives and fairness
- Customers with legitimate urgency, such as an emergency, closing on a home purchase or paying a bill on deadline.
- Customers responding to an actual breach, who change passwords and contact details and move money in one session.
- Power users (active traders, deal hunters) whose sessions are fast and direct.
- Accessibility users whose navigation follows different paths.
- Life events (divorce, bereavement, relocation), which produce bursts of changes and transfers.
Privacy and compliance considerations
- Clickstream data is personal data. Disclose it and retain it in line with fraud-prevention purposes. Avoid feeding fraud telemetry into marketing. See Privacy and Data Use in Fraud Prevention.
- Session evidence (sequence and timing) is valuable in Reg E error resolution, scam reimbursement decisions and SAR narratives. Preserve it in case records (Regulation E and Unauthorized Transfers, Case Documentation Standards).
Mechanisms it helps detect
Account Takeover (ATO) · Payout Redirection · Session Hijacking and Infostealers · Authorized Push Payment (APP) Scams · Impersonation Scams · Loyalty and Rewards Redemption Fraud · Business Logic Exploitation · Ramp-and-Dump via Account Takeover · ACATS Transfer Fraud · Seller Non-Delivery and Fake Listings
Related signals and controls
- Signals: Behavioral Biometrics, Login Anomalies, Account Change Events, Transaction Pattern Anomalies, Remote Access Tool Detection, Scam Victim Indicators, Trading Pattern Signals
- Controls: Real-Time Transaction Risk Scoring, Contact Change Cooling-Off Periods, Withdrawal and Payout Controls, Risk-Based Authentication and Step-Up
- Playbooks (members): Playbook - Account Takeover Members, Playbook - Payout and Withdrawal Risk Members, Playbook - Business Logic Exploit Response Members
Sources and further reading
- FinCEN Alert FIN-2024-Alert004: rapid transactions on new accounts and immediate withdrawal after deposit as red flags.
- NIST SP 800-63A-4: transaction analytics (IP, geolocation and velocity anomalies) as a recommended fraud check.
- FBI IC3 PSA I-031226-PSA (March 2026): ATO traffic disguised as local and routine, which makes in-session behavior more important than network signals.